Security readout for executives and security teams
Plain-English summary
This Linux kernel issue can crash a system when the software RDMA driver handles a failed socket creation during CIFS over RDMA mounting. The public record does not provide CVSS, confirmed impact beyond a NULL pointer dereference, or evidence of active exploitation.
Executive priority
Treat as a targeted availability risk for Linux hosts using software RDMA and CIFS over RDMA. Patch through normal kernel maintenance, faster for shared or business-critical storage clients. Current public evidence does not justify emergency response absent relevant exposure.
Technical view
In rdma_rxe, rxe_qp_do_cleanup() can dereference NULL after rxe_qp_init_req() fails to create a socket. The trace occurs via mount.cifs using SMB Direct/RDMA. The fix moves cleanup after a NULL pointer check. Linux stable commits are referenced for multiple maintained kernel lines.
Likely exposure
Exposure is most likely on Linux systems using or loading the rdma_rxe software RDMA module with CIFS/SMB over RDMA paths. General Linux servers without RDMA/rxe or CIFS over RDMA usage appear less likely to hit the vulnerable path, based on the provided trace.
Exploitation context
No KEV listing or cited source indicates active exploitation. The documented trigger is mount.cifs over RDMA when socket creation fails. The record supports a kernel NULL pointer dereference; it does not establish remote code execution or privilege escalation.
Researcher notes
The source bundle has no CVSS or CWE and includes ambiguous affected version data. Focus triage on the rdma_rxe cleanup path and vendor backports. Do not assume all Linux deployments are exposed; module availability and CIFS/RDMA usage matter.
Mitigation direction
- Identify Linux kernels using affected stable lines listed in the CVE record.
- Apply vendor kernel updates that include the referenced Linux stable fixes.
- If not needed, disable or avoid rdma_rxe and CIFS over RDMA usage per vendor guidance.
- Prioritize systems where untrusted users can initiate mounts or RDMA-backed SMB workflows.
Validation and detection
- Confirm running kernel version against vendor advisories and referenced stable commits.
- Check whether rdma_rxe is present, loadable, or actively used.
- Review whether CIFS mounts use RDMA/SMB Direct paths.
- Search kernel logs for rxe_qp_do_cleanup NULL dereference or related oops traces.
- Verify the installed kernel contains the applicable stable fix commit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50885 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ee24de095569935eba600f7735e8e8ddea5b418eCVE reference
- https://git.kernel.org/stable/c/7340ca9f782be6fbe3f64a134dc112772764f766CVE reference
- https://git.kernel.org/stable/c/bd7106a6004f1077a365ca7f5a99c7a708e20714CVE reference
- https://git.kernel.org/stable/c/6bb5a62bfd624039b05157745c234068508393a9CVE reference
- https://git.kernel.org/stable/c/f64f08b9e6fb305a25dd75329e06ae342b9ce336CVE reference
- https://git.kernel.org/stable/c/5b924632d84a60bc0c7fe6e9bbbce99d03908957CVE reference
- https://git.kernel.org/stable/c/821f9a18210f6b9fd6792471714c799607b25db4CVE reference
- https://git.kernel.org/stable/c/f67376d801499f4fa0838c18c1efcad8840e550dCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.